lkml.org 
[lkml]   [2016]   [May]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: [PATCH] kasan: improve double-free detection
Date
> 
> We can use per-header lock by setting status to KASAN_STATE_LOCKED. A
> thread can CAS any status to KASAN_STATE_LOCKED which means that it
> locked the header. If any thread tried to modify/read the status and
> the status is KASAN_STATE_LOCKED, then the thread waits.

Thanks, Dmitry. I've successfully tested with the concurrent free slab_test test
(alloc on cpu 0; then concurrent frees on all other cpus on a 12-vcpu KVM) using:

static inline bool kasan_alloc_state_lock(struct kasan_alloc_meta *alloc_info)
{
if (cmpxchg(&alloc_info->state, KASAN_STATE_ALLOC,
KASAN_STATE_LOCKED) == KASAN_STATE_ALLOC)
return true;
return false;
}

static inline void kasan_alloc_state_unlock_wait(struct kasan_alloc_meta
*alloc_info)
{
while (alloc_info->state == KASAN_STATE_LOCKED)
cpu_relax();
}

Race "winner" sets state to quarantine as the last step:

if (kasan_alloc_state_lock(alloc_info)) {
free_info = get_free_info(cache, object);
quarantine_put(free_info, cache);
set_track(&free_info->track, GFP_NOWAIT);
kasan_poison_slab_free(cache, object);
alloc_info->state = KASAN_STATE_QUARANTINE;
return true;
} else
kasan_alloc_state_unlock_wait(alloc_info);

Now, I'm not sure whether on current KASAN-supported archs, state byte load in
the busy-wait loop is atomic wrt the KASAN_STATE_QUARANTINE byte store.
Would you advise using CAS primitives for load/store here too?

> >
> > Sure, a new test can be added for test_kasan.ko. Unlike the other tests, a
> > double-free would likely panic the system due to slab corruption. Would it still
> > be "KASANic" for kasan_slab_free() to return true after reporting double-free
> > attempt error so thread will not call into __cache_free()? How does ASAN
> > handle this?
>
> Yes, sure, it is OK to return true from kasan_slab_free() in such case.
> Use-space ASAN terminates the process after the first report. We've
> decided that in kernel we better continue in best-effort manner. But
> after the first report all bets are mostly off (leaking an object is
> definitely OK).

sounds good; I'm also "promoting" double-free pr_err() to kasan_report().

Kuthonuzo
\
 
 \ /
  Last update: 2016-05-03 11:41    [W:0.457 / U:0.156 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site